So, I checked the Splunk licensing information here - https://www.splunk.com/en_us/products/pricing/calculator.html
Assuming that I go for a 100 GB per day perpetual license, it costs around 2700/GB.
What does this mean?
total costs = 2700*100= 270000 USD? Of course, this is a one time expense, provided I do not exceed 100GB of indexing per day.
Now, if I reduce my log per day to 95 GB at a peak, does this mean I will save 5*2700=13500 USD? Or, since I have already bought a perpetual license for 100GB and am not exceeding 100 GB of daily indexing volume, this just means I am within my limits and there is no savings, even if i ingest less data per day?
I'm not sure Splunk provide licensing billing on the volume of daily indexing data. Your Splunk Enterprise daily indexing volume should less or equal to the license you have. Check below link for FAQ.
If still not getting the answer I suggest you contact the salesperson for more information.
Hi @kamlesh_vaghela Thanks I had gone through the link you provided, it is not very clear. I do understand that this is a grey area. Excerpt from the link you posted -
Do I get a volume discount if I buy a larger Splunk Enterprise license?
Yes. Splunk Enterprise pricing has built-in volume discounts. You pay based on the amount of data indexed by your Splunk instance on a daily basis, calculated in GB per day. We determine the total plan price by multiplying your desired daily index volume by the unit price per GB. For example, the unit price per GB decreases by 67% as total daily index volume grows from 1GB/day to 100 GB/day.
So, as you see it does talk about the daily indexing volume. What I am asking is what happens if I am over provisioned? Do i have to pay less, be it even a small amount, or does it mean there is no payment reduction? All it means is that as long as I am less than/equal to my agrred upon daily indexing volume , i won't encounter any license violations/have to pay more. The window here is also an important consideration, is it a rolling 30 day period or something else? My gut feel says there are 0 savings in the scenario I described, but I wanted to ascertain more.
And no, I do not want to contact splunk sales, rather depend upon a ground report from users who might have faced this situation in real life 🙂
You do not get money back for indexing less than your quota. The license size is an upper bound. You can index any amount less than or equal to your limit for the same price.